I am writing on behalf of “M” Ltd., a qualified trust service provider (QTSP) in Member State “A”, active member of ETSI TC ESI, issuing qualified eIDAS certificates (QWACs and QSealCs) to payment service providers (PSPs) for identification and securing communication pursuant to PSD2 and the RTS on SCA/CSC.

In order to verify the PSD2-specific information to be included in certificates, we have contacted the national competent authority (NCA) supervising payment services in Member State “A”. During our discussions we have discovered that there are two possible interpretations of the RTS requirement on PSD2 authorisation number. “M” Ltd. kindly asks the European Banking Authority (EBA) for guidance regarding the correct interpretation of the RTS, in order to enable the QTSP to issue certificates conformant to legal requirements and facilitating easy and unambiguous identification of PSPs.

The RTS Article 34 paragraph (2) dictates:

“2. For the purpose of this Regulation, the registration number as referred to in the official records in accordance with Annex III (c) or Annex IV (c) to Regulation (EU) No 910/2014 shall be the authorisation number of the payment service provider issuing card-based payment instruments, the account information service providers and payment initiation service providers, including account servicing payment service providers providing such services, available in the public register of the home Member State pursuant to Article 14 of Directive (EU) 2015/2366 or resulting from the notifications of every authorisation granted under Article 8 of Directive 2013/36/EU of the European Parliament and of the Council in accordance with Article 20 of that Directive.”

In our understanding, the purpose of this authorisation number is to allow unique identification of the PSP, and also to facilitate verification of the authorisation status of the PSP in the public register of the home NCA or the public register of the European Banking Authority. EBA maintains two registers, which publish information provided by all the NCAs, corresponding to the two possible sources of verification mentioned in the RTS:

• EBA PSD2 register publishes a copy of the information “available in the public register of the home Member State pursuant to Article 14 of Directive (EU) 2015/2366” – this includes typically payment institutions and e-money institutions; available at: https://eba.europa.eu/risk-analysis-and-data/register-of-payment-and-e-money-institutions-under-psd2

• EBA credit institution register publishes a copy of the information “resulting from the notifications of every authorisation granted under Article 8 of Directive 2013/36/EU of the European Parliament and of the Council in accordance with Article 20 of that Directive” – this includes credit institutions; available at: https://eba.europa.eu/risk-analysis-and-data/credit-institutions-register

The two possible interpretations in the case of PSPs registered in Member State “A”:

1) The authorisation number is the number of the NCA resolution authorising the provision of payment services, which is not the same as the Registration number appearing in the NCA’s public register.

2) The authorisation number is the Registration number appearing in the NCA’s public register (which is a reference number formed based on the VAT number). 

We have investigated a number of cases in practice (see EXAMPLES in the attached file), the following table (see TABLE properly formatted in the attached file) summarizes our findings about the current situation:

NCA public register institution data page / Number of the resolution (as in interpretation 1)

- does not contain this number

- is not searchable by this number

NCA public register institution data page / Registration number (as in interpretation 2)

- contains this number

- is searchable by this number

- contains all current activity permissions

NCA resolution archives / Number of the resolution (as in interpretation 1)

- contains this number for PSPs authorised since 2010, but only as part of the resolution text (PDF or HTML)

- does not contain this number for PSPs authorised before 2010

- is searchable by this number when it contains it

NCA resolution archives / Registration number (as in interpretation 2)

- does not contain this number

- does not contain current activity permissions (in a compiled list)

EBA PSD2 register / Number of the resolution (as in interpretation 1)

- does not contain this number

- is not searchable by this number

EBA PSD2 register / Registration number (as in interpretation 2)

- contains this number in the field “National Identification Number”

- is searchable by this number

- contains all current activity permissions

EBA credit institution register / Number of the resolution (as in interpretation 1)

- does not contain this number

- is not searchable by this number

EBA credit institution register / Registration number (as in interpretation 2)

- contains this number in the field “National Reference”

- is searchable by name only

- contains the CRD institution type

Based on our findings we concluded that using the number of the NCA resolution (as in interpretation 1) as the authorisation number in eIDAS certificates would cause significant difficulties in verification of authorisations of PSPs, and would also cause unnecessary expenses for NCA (in order to provide the information as required by PSD2) and for ASPSPs (relying on the certificates to verify authorisations against NCA register) as well.